From d7977bab93b100af70b1c394ff3be2335635a2ef Mon Sep 17 00:00:00 2001
From: Andrew Gunnerson <accounts+github@chiller3.com>
Date: Mon, 4 Sep 2023 17:04:32 -0400
Subject: [PATCH] cargo-deny: Block executables in dependencies

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
---
 deny.toml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/deny.toml b/deny.toml
index adf21f0..9961cf6 100644
--- a/deny.toml
+++ b/deny.toml
@@ -5,6 +5,7 @@ yanked = "deny"
 notice = "deny"
 
 [licenses]
+include-dev = true
 unlicensed = "deny"
 allow = [
     "Apache-2.0",
@@ -26,11 +27,21 @@ license-files = [
 
 [bans]
 multiple-versions = "warn"
+multiple-versions-include-dev = true
 deny = [
     # https://github.com/serde-rs/serde/issues/2538
     { name = "serde_derive", version = ">=1.0.172,<1.0.184" },
 ]
 
+[bans.build]
+executables = "deny"
+include-dependencies = true
+include-workspace = true
+bypass = [
+    # Copies of unmodified crashwrangler objects for old macOS versions.
+    { name = "honggfuzz", allow-globs = ["honggfuzz/third_party/mac/CrashReport_*.o"] },
+]
+
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"